Added two-factor authentication with an authenticator app
In the Security tab of your account page, enable two-factor authentication with your authenticator app and the six-digit code it gives you. From then on, every sign-in asks for a fresh code, and so does turning the protection off. A notification tells you each time it is enabled or disabled. A reminder invites you to set it up, with the choice to decide later; new accounts get a week before seeing it.